PROVENANCEAlways visible Source + version + freshness
Know the source. Understand the answer.{ } REST API
EVERY ANSWER HAS A SOURCE.
07tracked data integrations
v4+v6IPv4 and IPv6 address support
◷Independent source refreshes
{ }One predictable REST API
01 / EXPLORE THE INTELLIGENCE
Look up an IP. See the source.
See the estimated location, network, and the data behind each result.
Example mode
10 sample lookups left today · Resets at 00:00 UTC
ILLUSTRATIVE DATA
🇺🇸
APPROXIMATE LOCATION
Mountain View, United States
↗
IP address8.8.8.8
RegionCalifornia
Country codeUS
Time zoneAmerica/Los_Angeles
NetworkAS15169 · Google LLC
IP versionIPv4
ⓘ Sample response for exploration. IP locations are approximate, not GPS coordinates.
◎ Illustrative location
This preview uses example responses and a browser-local counter. Production lookups require the PHP service, approved datasets, and server-enforced quotas.
02 / GO BEYOND THE COORDINATES
More than a pin on a map.
Build for where people are. And understand the data that gets you there.
IP geolocation is an estimate. Country results are generally more stable than city results. Mobile networks, VPNs, and routing changes can affect location. ORIGOOO shows provenance and uncertainty rather than a numerical accuracy guarantee.
Are all seven integrations independent?
No. Distributions may mirror upstream records. ORIGOOO tracks lineage so mirrored datasets do not count as independent votes. The registry shows each integration’s role and readiness.
How do the free allowances work?
The public website allowance is 10 lookup actions per visitor per UTC day. Registered Free accounts receive 1,000 API credits per month. Standard lookups cost one credit and all-source comparisons cost two. The preview uses sample data only.
Can I use this to block access by country?
Country policies must be enforced on your server. A frontend widget alone does not secure content. SDK policies should define trusted proxies, caching, and how unknown locations and service outages are handled.
DEVELOPER DOCUMENTATION
Credentials with boundaries.
Server calls use Authorization: Bearer KEY or X-API-Key. API keys are HMAC digests with independently revocable records, scopes, optional IP/CIDR restrictions and exact origin allowlists.
Secret and publishable keys
Secret keys stay in server environments. Publishable widget keys require an allowed browser origin and have restricted lookup scopes; a browser origin is not a secret. Both use the workspace’s atomic allowance.
Account security
Email verification gates key creation. Passwords use Argon2id where available, with bcrypt fallback. Reset links expire after 30 minutes and revoke existing sessions. Dashboard writes require CSRF tokens and HttpOnly, Secure, SameSite cookies.
Google OIDC
Configure a web client and exact callback /api/auth/google/callback. The implementation binds state, nonce and PKCE to the session and validates the signed ID token’s issuer, audience, expiry and verified email. It does not automatically link a new Google identity to an existing email account.
